Updated 31 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

130 results · page 1 of 3

Sep 3, 2020An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition.CVE-2020-11579 · Other software · Chadhaajay · reported by MITREHigh 7.5
An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com shielder.it
Mar 12, 2020CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request.CVE-2020-10504 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request.CVE-2020-10503 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request.CVE-2020-10502 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request.CVE-2020-10501 · Other software · Chadhaajay · reported by MITREMedium 6.5
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request.CVE-2020-10500 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request.CVE-2020-10499 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.CVE-2020-10498 · Other software · Chadhaajay · reported by MITREMedium 6.5
CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request.CVE-2020-10497 · Other software · Chadhaajay · reported by MITREMedium 6.5
CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request.CVE-2020-10496 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request.CVE-2020-10495 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.CVE-2020-10494 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request.CVE-2020-10493 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request.CVE-2020-10492 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request.CVE-2020-10491 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a department via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request.CVE-2020-10490 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request.CVE-2020-10489 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a ticket via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.CVE-2020-10488 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a news article via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request.CVE-2020-10487 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a comment via a crafted request.CVE-2020-10486 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a comment via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article via a crafted request.CVE-2020-10485 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.CVE-2020-10484 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request.CVE-2020-10483 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request.CVE-2020-10482 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/add-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new glossary term via a crafted request.CVE-2020-10481 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new glossary term via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request.CVE-2020-10480 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.CVE-2020-10479 · Other software · Chadhaajay · reported by MITREMedium 4.3
CSRF in admin/add-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new news article via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution oCVE-2020-10478 · Other software · Chadhaajay · reported by MITREHigh 8.8
CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sCVE-2020-10477 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parametCVE-2020-10476 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameteCVE-2020-10475 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parametCVE-2020-10474 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET paramCVE-2020-10473 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameCVE-2020-10472 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parametCVE-2020-10471 · Other software · Chadhasoftware · reported by MITREMedium 4.8
Reflected XSS in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameterCVE-2020-10470 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET paraCVE-2020-10469 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.CVE-2020-10468 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter CVE-2020-10467 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameterCVE-2020-10466 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameterCVE-2020-10465 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter CVE-2020-10464 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameterCVE-2020-10463 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.CVE-2020-10462 · Other software · Chadhaajay · reported by MITREMedium 4.8
Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020The way comments in article.php (vulnerable function in include/functions-article.php) are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers toCVE-2020-10461 · Other software · Chadhaajay · reported by MITREMedium 6.1
The way comments in article.php (vulnerable function in include/functions-article.php) are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored (Blind) XSS (injecting arbitrary web script or HTML) in admin/manage-comments.php, via the GET parameter cmt.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV filCVE-2020-10460 · Other software · Chadhaajay · reported by MITREMedium 4.9
admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Path Traversal in admin/assetmanager/assetmanager.php (vulnerable function saved in admin/assetmanager/functions.php) in Chadha PHPKB Standard Multi-Language 9 CVE-2020-10459 · Other software · Chadhaajay · reported by MITRELow 2.7
Path Traversal in admin/assetmanager/assetmanager.php (vulnerable function saved in admin/assetmanager/functions.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to list the files that are stored on the webserver using a dot-dot-slash sequence (../) via the POST parameter inpCurrFolder.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-CVE-2020-10458 · Other software · Chadhaajay · reported by MITREMedium 6.5
Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence (../) via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a doCVE-2020-10457 · Other software · Chadhaajay · reported by MITRELow 2.7
Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence (../) via the POST parameter imgName (for the new name) and imgUrl (for the current file to be renamed).
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it
Mar 12, 2020The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/trCVE-2020-10456 · Other software · Chadhaajay · reported by MITREMedium 4.8
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/trash-box.php by adding a question mark (?) followed by the payload.
Product
Phpkb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record antoniocannito.it antoniocannito.it

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.